Mobile App for Access Control Systems: Integration & Remote Management

Implementing Access Control System (ACS) Management via Mobile App

Integrating a mobile app with an ACS hits the wall of protocol incompatibility. Controllers like Suprema BioStar, HID OSDP, Ironlogic Z-5R, RusGuard each have their own API and data format. We solve this by creating a unified interface over REST or OSDP v2 that works equally well for iOS and Android. Thanks to this approach, customers save up to 40% on implementation time, avoiding rewriting logic for each controller.

The mobile app handles three critical functions: real-time access event monitoring, remote door control, and flexible access rights management. Without this, security guards are stuck at a console and HR fills out paper forms. With our app, all operations take a few taps, and security incident costs drop by up to 50% due to instant reaction.

Problems We Solve

Event delays. Standard REST API polling every 2-5 seconds misses events during a turnstile rush. We use WebSocket (BioStar 2 supports /ws/events) for a real-time feed. Our delay between passage and event appearance in the app is under 500 ms — 4x faster than polling.

Remote unlock security. Opening a door with a button in the app is convenient but dangerous without protection. An intercepted request can be replayed. We implement HMAC-SHA256 signing with a timestamp, making replay impossible after 30 seconds. Every unlock is logged on the server.

Card and rights management. Manually entering a 10-digit Mifare card number invites errors. We add NFC reading: the guard taps the card to the phone, and the number is picked up automatically. Then selecting doors and time schedules via an intuitive form. Card addition time drops from 30 to 5 seconds, and entry errors fall to zero.

How We Do It: Stack and Integration

For controller integration we use REST API (Suprema BioStar 2, HID Mercury) or OSDP v2 over TCP. In a Kotlin Multiplatform project, the access event structure looks like this:

data class AccessEvent( val id: Long, val timestamp: Instant, val deviceId: Long, val doorId: Long, val userId: Long?, val cardNumber: String?, val eventCode: Int, val temperature: Double?, val imageData: String? ) 

The live WebSocket feed is a standard component. Kotlin code using OkHttp:

class AcsEventStream(private val url: String, private val token: String) { fun observe(): Flow<AccessEvent> = callbackFlow { val client = OkHttpClient.Builder() .readTimeout(0, TimeUnit.MILLISECONDS) .build() val ws = client.newWebSocket( Request.Builder().url(url) .header("Authorization", "Bearer $token").build(), object : WebSocketListener() { override fun onMessage(webSocket: WebSocket, text: String) { val event = Json.decodeFromString<AccessEvent>(text) trySend(event) } override fun onFailure(webSocket: WebSocket, t: Throwable, response: Response?) { close(t) } } ) awaitClose { ws.close(1000, null) } } } 

Why Remote Unlock Security Is Critical

Any door unlock request must be signed and verified server-side. Our implementation on Android/iOS:

suspend fun unlockDoor(doorId: Long) { val timestamp = System.currentTimeMillis() val payload = "$timestamp:$doorId:${authService.userId}" val signature = hmacSha256(payload, authService.apiSecret) api.unlockDoor(DoorUnlockRequest( doorId = doorId, timestamp = timestamp, signature = signature, reason = "manual_unlock_mobile" )) } 

The server checks: timestamp ≤ 30 seconds, signature matches, user has door:unlock permission. Without these checks, an attacker intercepting traffic could replay the request.

How to Integrate NFC for Card Reading

On Android we use NfcAdapter, on iOS — CoreNFC. Tap the card to the phone, the app reads the UID and sends it to the server to bind to the user. This cuts card addition time from 30 to 5 seconds and eliminates input errors.

What's Included in the Work

We deliver not just an app, but a complete package: source code, API integration documentation, server-side access (if needed), admin training, and 3 months of post-launch support. All fixed in the contract, allowing you to evolve the system independently.

Process

Estimated Timelines

An MVP with basic features: event feed, remote unlock, NFC card management — from 4 to 7 weeks. Cost is calculated individually after reviewing the specific system's API and security requirements.

Typical Mistakes in ACS App Development

• No replay protection for door unlock requests.
• Server-side permission checks ignored (client decides what's allowed).
• Long REST polling intervals instead of WebSocket.
• Manual card number entry without NFC.

We have 5+ years of experience developing mobile apps for ACS and over 20 implemented projects for clients in Russia and the CIS. We guarantee correct integration with any API and security compliant with App Store Review Guidelines.

Interested? Get a consultation for your project — we'll assess integration complexity and propose a solution. Contact us to discuss details.

Note: Our team holds iOS and Android development certifications and has hands-on experience with Suprema BioStar, HID, and RusGuard.